OTPulse

Windows Win32k Elevation of Privilege Vulnerability

Plan PatchCVSS 7.8CVE-2026-62876Aug 11, 2026
Microsoft
IT in OT - Windows Server and Active Directory are widely deployed in OT environments
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary

An out-of-bounds read vulnerability in Windows Win32k graphics kernel component allows an authorized local attacker to elevate privileges and gain administrator access. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1), and Windows Server (2016, 2019, 2022, 2025). Microsoft rates exploitation as less likely and recommends applying the August 2026 security update.

What this means
What could happen
An attacker with a user account on a Windows system could run commands with administrator privileges, potentially gaining full control of the device and any systems it manages (such as PLCs, SCADA workstations, or engineering computers).
Who's at risk
Windows systems used in OT environments, including engineering workstations, SCADA/HMI servers, historian systems, and any Windows-based industrial control devices. This affects Windows 10 (all versions), Windows 11 (all versions), Windows Server 2016, 2019, 2022, and 2025 installations.
How it could be exploited
An attacker must first gain a user account on the Windows system (through phishing, weak credentials, or local access). They can then run a crafted program that exploits an out-of-bounds read in Win32k to escape their user-level restrictions and gain admin-level privileges, allowing them to execute arbitrary commands.
Prerequisites
  • Valid user account on the affected Windows system
  • Local execution capability (ability to run code on the machine)
Low complexity exploitationRequires valid user accountLocal attack vector onlyAffects Windows systems throughout OT infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (26)
26 with fix
ProductAffected VersionsFix Status
Windows 10 Version 1809 for 32-bit SystemsAll versionsBuild 10.0.17763.9115
Windows 10 Version 1809 for x64-based SystemsAll versionsBuild 10.0.17763.9115
Windows Server 2019All versionsBuild 10.0.17763.9115
Windows Server 2019 (Server Core installation)All versionsBuild 10.0.17763.9115
Windows Server 2022All versionsBuild 10.0.20348.5499
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

Windows Server 2016
HOTFIXApply the August 2026 Windows security update to all affected Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025 systems
Long-term hardening
0/2
HARDENINGRestrict user account creation and enforce strong password policies to reduce the risk of unauthorized local access
HARDENINGImplement application whitelisting or endpoint protection to block execution of unknown or suspicious programs
View full vendor advisory
API: /api/v1/advisories/5241838c-b92f-4a4d-8831-6ce9ca663275

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.